20.traefik acme证书获取

git clone https://github.com/acmesh-official/acme.sh.git

cd acme.sh/

./acme.sh install

export Ali_Key="xxx"

export Ali_Secret="xxx"

./acme.sh --issue --dns dns_ali -d viomi.pursuit.site -d whoami.pursuit.site

AccessKey ID

LTAI4G6yrCBsfs5ac4rSVS6z

AccessKey Secret

Onhoq3qTHaxoxCMR5PjxoaVZunwjY3

apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "29" field.cattle.io/publicEndpoints: '[{"addresses":["120.92.93.90"],"port":80,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8080,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":9000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":443,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false}]' creationTimestamp: "2020-10-15T06:59:17Z" generation: 45 labels: k8s-app: traefik2 name: traefik2 namespace: default resourceVersion: "4087321" selfLink: /apis/apps/v1/namespaces/default/deployments/traefik2 uid: f13f017a-0eb3-11eb-b925-92e258d1967a spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: k8s-app: traefik2 strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: k8s-app: traefik2 spec: containers: - args: - --log.level=DEBUG - --api - --api.insecure - --entrypoints.web.address=:80 - --entryPoints.websecure.Address=:443 - --certificatesResolvers.ali.acme.dnsChallenge=true - --certificatesResolvers.ali.acme.dnsChallenge.provider=alidns - --certificatesresolvers.ali.acme.email=linsheng@viomi.com - --certificatesresolvers.ali.acme.dnsChallenge.delayBeforeCheck=0 - --certificatesresolvers.ali.acme.storage=acme.json - --certificatesresolvers.ali.acme.caserver=https://acme-v02.api.letsencrypt.org/directory - --providers.kubernetescrd env: - name: ALICLOUD_ACCESS_KEY value: LTAI4G6yrCBsfs5ac4rSVS6z - name: ALICLOUD_SECRET_KEY value: Onhoq3qTHaxoxCMR5PjxoaVZunwjY3 image: traefik:v2.3 imagePullPolicy: IfNotPresent name: traefik2 ports: - containerPort: 80 name: web protocol: TCP - containerPort: 443 name: websecure protocol: TCP - containerPort: 8080 name: admin protocol: TCP - containerPort: 9000 name: udpep protocol: TCP resources: {} securityContext: capabilities: {} procMount: Default terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: traefikv2 serviceAccountName: traefikv2 terminationGracePeriodSeconds: 30

apiVersion: v1

kind: Service

metadata:

name: traefik2

namespace: default

spec:

clusterIP: 10.254.106.41

externalTrafficPolicy: Cluster

ports:

- name: web

nodePort: 32485

port: 80

protocol: TCP

targetPort: 80

- name: 8080web

nodePort: 31314

port: 8080

protocol: TCP

targetPort: 8080

- name: udb

nodePort: 30564

port: 9000

protocol: TCP

targetPort: 9000

- name: tcp8000

nodePort: 30717

port: 8000

protocol: TCP

targetPort: 8000

- name: websecure

nodePort: 31203

port: 443

protocol: TCP

targetPort: 443

selector:

k8s-app: traefik2

sessionAffinity: None

type: LoadBalancer

status:

loadBalancer:

ingress:

- ip: 120.92.93.90

apiVersion: v1

kind: Service

metadata:

name: whoami

spec:

ports:

- protocol: TCP

name: web

port: 80

selector:

app: whoami

---

apiVersion: traefik.containo.us/v1alpha1

kind: IngressRoute

metadata:

name: simpleingressroute

namespace: default

spec:

entryPoints:

- web

routes:

- match: Host(`viomi.pursuit.site`) && PathPrefix(`/notls`)

kind: Rule

services:

- name: whoami

port: 80

---

apiVersion: traefik.containo.us/v1alpha1

kind: IngressRoute

metadata:

name: ingressroutetls

namespace: default

spec:

entryPoints:

- websecure

routes:

- match: Host(`viomi.pursuit.site`) && PathPrefix(`/tls.html`)

kind: Rule

services:

- name: whoami

port: 80

tls:

certResolver: ali

domains:

- main: "pursuit.site"

sans:

- "*.pursuit.site"

v1.7traefik（ingress)

apiVersion: apps/v1

kind: Deployment

metadata:

annotations:

deployment.kubernetes.io/revision: "6"

field.cattle.io/publicEndpoints: '[{"addresses":["120.92.93.90"],"port":80,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8080,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":9000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":443,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false}]'

kubectl.kubernetes.io/last-applied-configuration: |

{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"k8s-app":"traefik2"},"name":"traefikv2","namespace":"default"},"spec":{"progressDeadlineSeconds":600,"replicas":0,"revisionHistoryLimit":10,"selector":{"matchLabels":{"k8s-app":"traefik2"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"creationTimestamp":null,"labels":{"k8s-app":"traefik2"}},"spec":{"containers":[{"args":["--api","--kubernetes","--configfile=/traefik.toml","--insecureskipverify","--logLevel=INFO","--defaultEntryPoints=http,https","--entrypoints=Name:https Address::443 TLS","--entrypoints=Name:http Address::80","--acme","--acme.email=linsheng@viomi.com.cn","--acme.storage=/tmp/acme.json","--acme.acmeLogging=true","--acme.entryPoint=https","--acme.httpchallenge.entrypoint=http","--acme.dnschallenge","--acme.dnschallenge.provider=alidns","--acme.dnschallenge.delaybeforecheck=5","--acme.onHostRule=true","--acme.domains=viomi.pursuit.site"],"env":[{"name":"ALICLOUD_ACCESS_KEY","value":"LTAI4G6yrCBsfs5ac4rSVS6z"},{"name":"ALICLOUD_SECRET_KEY","value":"Onhoq3qTHaxoxCMR5PjxoaVZunwjY3"}],"image":"traefik:1.7.19","imagePullPolicy":"IfNotPresent","name":"traefik2","ports":[{"containerPort":80,"name":"web","protocol":"TCP"},{"containerPort":443,"name":"websecure","protocol":"TCP"},{"containerPort":8080,"name":"admin","protocol":"TCP"},{"containerPort":9000,"name":"udpep","protocol":"TCP"}],"resources":{},"securityContext":{"capabilities":{},"procMount":"Default"},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"traefikv2","serviceAccountName":"traefikv2","terminationGracePeriodSeconds":30}}}}

creationTimestamp: "2020-10-19T02:14:20Z"

generation: 11

labels:

k8s-app: traefik2

name: traefikv2

namespace: default

resourceVersion: "4082401"

selfLink: /apis/apps/v1/namespaces/default/deployments/traefikv2

uid: cc1cba86-11b0-11eb-b925-92e258d1967a

spec:

progressDeadlineSeconds: 600

replicas: 0

revisionHistoryLimit: 10

selector:

matchLabels:

k8s-app: traefik2

strategy:

rollingUpdate:

maxSurge: 25%

maxUnavailable: 25%

type: RollingUpdate

template:

metadata:

creationTimestamp: null

labels:

k8s-app: traefik2

spec:

containers:

- args:

- --api

- --kubernetes

- --configfile=/traefik.toml

- --insecureskipverify

- --logLevel=INFO

- --defaultEntryPoints=http,https

- --entrypoints=Name:https Address::443 TLS

- --entrypoints=Name:http Address::80

- --acme

- --acme.email=linsheng@viomi.com.cn

- --acme.storage=/tmp/acme.json

- --acme.acmeLogging=true

- --acme.entryPoint=https

- --acme.httpchallenge.entrypoint=http

- --acme.dnschallenge

- --acme.dnschallenge.provider=alidns

- --acme.dnschallenge.delaybeforecheck=5

- --acme.onHostRule=true

- --acme.domains=viomi.pursuit.site

- --acme.domains=whoami.pursuit.site

env:

- name: ALICLOUD_ACCESS_KEY

value: LTAI4G6yrCBsfs5ac4rSVS6z

- name: ALICLOUD_SECRET_KEY

value: Onhoq3qTHaxoxCMR5PjxoaVZunwjY3

image: traefik:1.7.19

imagePullPolicy: IfNotPresent

name: traefik2

ports:

- containerPort: 80

name: web

protocol: TCP

- containerPort: 443

name: websecure

protocol: TCP

- containerPort: 8080

name: admin

protocol: TCP

- containerPort: 9000

name: udpep

protocol: TCP

resources: {}

securityContext:

capabilities: {}

procMount: Default

terminationMessagePath: /dev/termination-log

terminationMessagePolicy: File

dnsPolicy: ClusterFirst

restartPolicy: Always

schedulerName: default-scheduler

securityContext: {}

serviceAccount: traefikv2

serviceAccountName: traefikv2

terminationGracePeriodSeconds: 30

status:

conditions:

- lastTransitionTime: "2020-10-19T02:14:20Z"

lastUpdateTime: "2020-10-19T02:58:39Z"

message: ReplicaSet "traefikv2-67f7996577" has successfully progressed.

reason: NewReplicaSetAvailable

status: "True"

type: Progressing

- lastTransitionTime: "2020-10-19T03:24:06Z"

lastUpdateTime: "2020-10-19T03:24:06Z"

message: Deployment has minimum availability.

reason: MinimumReplicasAvailable

status: "True"

type: Available

observedGeneration: 11

apiVersion: v1

kind: Service

metadata:

annotations:

field.cattle.io/ipAddresses: "null"

field.cattle.io/publicEndpoints: '[{"addresses":["120.92.93.90"],"port":80,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8080,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":9000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":8000,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false},{"addresses":["120.92.93.90"],"port":443,"protocol":"TCP","serviceName":"default:traefik2","allNodes":false}]'

field.cattle.io/targetDnsRecordIds: "null"

field.cattle.io/targetWorkloadIds: "null"

kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","kind":"Service","metadata":{"annotations":{"field.cattle.io/publicEndpoints":"[{\"addresses\":[\"120.92.93.90\"],\"port\":80,\"protocol\":\"TCP\",\"serviceName\":\"default:traefik2\",\"allNodes\":false},{\"addresses\":[\"120.92.93.90\"],\"port\":443,\"protocol\":\"TCP\",\"serviceName\":\"default:traefik2\",\"allNodes\":false},{\"addresses\":[\"120.92.93.90\"],\"port\":8080,\"protocol\":\"TCP\",\"serviceName\":\"default:traefik2\",\"allNodes\":false},{\"addresses\":[\"120.92.93.90\"],\"port\":9000,\"protocol\":\"TCP\",\"serviceName\":\"default:traefik2\",\"allNodes\":false},{\"addresses\":[\"120.92.93.90\"],\"port\":8000,\"protocol\":\"TCP\",\"serviceName\":\"default:traefik2\",\"allNodes\":false}]","service.beta.kubernetes.io/ksc-loadbalancer-id":"75b5f3a8-e01c-426b-a2ca-8a916d69c9a8"},"creationTimestamp":"2020-10-15T05:58:50Z","name":"traefik2","namespace":"default","resourceVersion":"3522554","selfLink":"/api/v1/namespaces/default/services/traefik2","uid":"7fa34f70-0eab-11eb-b925-92e258d1967a"},"spec":{"clusterIP":"10.254.106.41","externalTrafficPolicy":"Cluster","ports":[{"name":"web","nodePort":32485,"port":80,"protocol":"TCP","targetPort":80},{"name":"tls","nodePort":30871,"port":443,"protocol":"TCP","targetPort":80},{"name":"8080web","nodePort":31314,"port":8080,"protocol":"TCP","targetPort":8080},{"name":"udb","nodePort":30564,"port":9000,"protocol":"TCP","targetPort":9000},{"name":"tcp8000","nodePort":30717,"port":8000,"protocol":"TCP","targetPort":8000}],"selector":{"k8s-app":"traefik2"},"sessionAffinity":"None","type":"LoadBalancer"},"status":{"loadBalancer":{"ingress":[{"ip":"120.92.93.90"}]}}}'

service.beta.kubernetes.io/ksc-loadbalancer-id: 75b5f3a8-e01c-426b-a2ca-8a916d69c9a8

creationTimestamp: "2020-10-15T06:31:20Z"

name: traefik2

namespace: default

resourceVersion: "4082602"

selfLink: /api/v1/namespaces/default/services/traefik2

uid: 097ef990-0eb0-11eb-b925-92e258d1967a

spec:

clusterIP: 10.254.106.41

externalTrafficPolicy: Cluster

ports:

- name: web

nodePort: 32485

port: 80

protocol: TCP

targetPort: 80

- name: 8080web

nodePort: 31314

port: 8080

protocol: TCP

targetPort: 8080

- name: udb

nodePort: 30564

port: 9000

protocol: TCP

targetPort: 9000

- name: tcp8000

nodePort: 30717

port: 8000

protocol: TCP

targetPort: 8000

- name: websecure

nodePort: 31203

port: 443

protocol: TCP

targetPort: 443

selector:

k8s-app: traefik2

sessionAffinity: None

type: LoadBalancer

status:

loadBalancer:

ingress:

- ip: 120.92.93.90

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1beta1

metadata:

name: traefik-ingress-controller

namespace: kube-system

rules:

- apiGroups:

- ""

resources:

- services

- endpoints

- secrets

verbs:

- get

- list

- watch

- apiGroups:

- extensions

resources:

- ingresses

verbs:

- get

- list

- watch

- apiGroups:

- extensions

resources:

- ingresses/status

verbs:

- update

- apiGroups:

- traefik.containo.us

resources:

- middlewares

- ingressroutes

- traefikservices

- ingressroutetcps

- ingressrouteudps

- tlsoptions

- tlsstores

verbs:

- get

- list

- watch

---

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1beta1

metadata:

name: traefik-ingress-controller

namespace: kube-system

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: traefik-ingress-controller

#namespace: kube-system

subjects:

- kind: ServiceAccount

name: traefik-ingress-controller

namespace: kube-system

kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1beta1

metadata:

name: traefik-ingress-controller

namespace: kube-system

rules:

- apiGroups:

- ""

resources:

- services

- endpoints

- secrets

verbs:

- get

- list

- watch

- apiGroups:

- extensions

resources:

- ingresses

verbs:

- get

- list

- watch

- apiGroups:

- extensions

resources:

- ingresses/status

verbs:

- update

- apiGroups:

- traefik.containo.us

resources:

- middlewares

- ingressroutes

- traefikservices

- ingressroutetcps

- ingressrouteudps

- tlsoptions

- tlsstores

verbs:

- get

- list

- watch

---

kind: ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1beta1

metadata:

name: traefik-ingress-controller

namespace: kube-system

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: ClusterRole

name: traefik-ingress-controller

subjects:

- kind: ServiceAccount

name: traefik-ingress-controller

namespace: kube-system

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

name: ingressroutes.traefik.containo.us

spec:

group: traefik.containo.us

version: v1alpha1

names:

kind: IngressRoute

plural: ingressroutes

singular: ingressroute

scope: Namespaced

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

name: middlewares.traefik.containo.us

spec:

group: traefik.containo.us

version: v1alpha1

names:

kind: Middleware

plural: middlewares

singular: middleware

scope: Namespaced

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

name: ingressroutetcps.traefik.containo.us

spec:

group: traefik.containo.us

version: v1alpha1

names:

kind: IngressRouteTCP

plural: ingressroutetcps

singular: ingressroutetcp

scope: Namespaced

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

name: ingressrouteudps.traefik.containo.us

spec:

group: traefik.containo.us

version: v1alpha1

names:

kind: IngressRouteUDP

plural: ingressrouteudps

singular: ingressrouteudp

scope: Namespaced

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDefinition

metadata:

name: tlsoptions.traefik.containo.us

spec:

group: traefik.containo.us

version: v1alpha1

names:

kind: TLSOption

plural: tlsoptions

singular: tlsoption

scope: Namespaced

---

apiVersion: apiextensions.k8s.io/v1beta1

kind: CustomResourceDef